Off-Path TCP Hijacking Attacks Via The Side Channel of Downgraded IPID

IEEE/ACM TRANSACTIONS ON NETWORKING, VOL. 30, NO.
1, FEBRUARY 2022 409
Off-Path TCP Hijacking Attacks via the Side

Channel of Downgraded IPID
Xuewei Feng , Qi Li , Senior Member, IEEE, Kun Sun , Member, IEEE, Chuanpu Fu,
and Ke Xu , Senior Member, IEEE, Member, ACM
Abstract— In this paper, we uncover a new off-path TCP I. I NTRODUCTION

hijacking attack that can be used to terminate victim TCP
connections or inject forged data into victim TCP connections
by manipulating the new mixed IPID assignment method, which
is widely used in Linux kernel version 4.18 and beyond. Our
S INCE the transmission control protocol (TCP) was first
presented in RFC 793 in 1981 [1], more than 100 TCP
related RFCs have been released to improve the protocol [2].
attack has three steps. First, an off-path attacker can downgrade Consequently, it becomes difficult for off-path attackers to
the IPID assignment for TCP packets from the more secure per- hijack TCP connections, mainly due to the challenge of infer-
socket-based policy to the less secure hash-based policy, thus ring the 32-bit random sequence numbers and acknowledg-
building a shared IPID counter that forms a side channel in ment numbers of a targeted TCP connection [1], [3]–[5]. When
the victim. Second, the attacker detects the presence of TCP
connections by observing the side channel of the shared IPID launching a brute-force attack, the attacker has to flood more
counter. Third, the attacker infers sequence and acknowledgment than 300 million spoofed packets at a time to the target systems
numbers of the detected connection by observing the side channel. that support both RFC 793 [1] and RFC 5961 [6]. Hence,
Consequently, the attacker can completely hijack the connection, off-path TCP attacks mainly rely on discovering side channel
e.g., resetting the connection or poisoning the data stream. vulnerabilities to facilitate the inference of the sequence and
We evaluate the impacts of our attack in the real world, and acknowledgment numbers [7]–[11]. Fortunately, most of the
we uncover that more than 20% of Alexa top 100k websites
uncovered vulnerabilities have been fixed or constrained by
are vulnerable to our attack. Our case studies of SSH DoS,
manipulating web traffic, and poisoning BGP routing tables the security community [7]–[9].
show its threat on a wide range of applications. Moreover, In this paper, we uncover a new off-path TCP hijacking
we demonstrate that our attack can be further extended to exploit attack that exploits the mixed IPID assignment method in the
IPv4/IPv6 dual-stack networks on increasing the hash collisions latest Linux kernels (i.e., version 4.18 and beyond) to either
and enlarging vulnerable populations. Finally, we analyze the terminate victim TCP connections or inject malicious data into
root cause and develop a new IPID assignment method to defeat victim TCP connections. First, our attack tricks the victim
this attack. We prototype our defense in Linux 4.18 and confirm
its effectiveness in the real world. Linux machine into adopting the hash-based IPID assignment
policy, instead of the by default more secure per-socket-based
Index Terms— Side-channel, off-path exploit, hash collisions, IPID assignment policy. Once the IPID assignment policy for
IPID assignment. socket protocols (TCP in our attack) is downgraded, it builds a
side channel based on the IPID hash collisions of the globally
Manuscript received May 24, 2021; revised September 1, 2021; accepted
shared 2048 hash counters, i.e., identifying a shared IPID
September 15, 2021; approved by IEEE/ACM T RANSACTIONS ON N ET- counter on the victim by leveraging hash collisions. Second,
WORKING Editor K. Ren. Date of publication October 1, 2021; date of by observing the shared IPID counter, an off-path attacker can
current version February 17, 2022. This work was supported in part by the detect the presence of TCP connections on the victim. Third,
National Key Research and Development Program of China under Grant
2018YFB0803405, in part by China National Funds for Distinguished Young the attacker infers sequence and acknowledgment numbers of
Scientists under Grant 61825204, in part by the National Natural Science the victim connection to completely hijack the connection.
Foundation of China under Grant 61932016 and Grant 62132011, in part by This new attack does not need any assistance of puppets,
the U.S. Office of Naval Research (ONR) under Grant N00014-16-1-3214 and
Grant N00014-18-2893, in part by the U.S. Army Research Office (ARO)
i.e., unprivileged applications or sandboxed scripts controlled
under Grant W911NF-17-1-0447, in part by Beijing Outstanding Young by attackers on victim hosts [7], [12], [13].
Scientist Program under Grant BJJWZYJH01201910003011, and in part by The Identification field of IP protocol (IPID) is
Beijing National Research Center for Information Science and Technol- used to indicate the uniqueness of a packet [14], [15]. After
ogy (BNRist) under Grant BNR2019RC01011 and Grant BNR2020RC01013.
(Corresponding author: Ke Xu.) abandoning two previous vulnerable IPID assignment methods
Xuewei Feng, Chuanpu Fu, and Ke Xu are with Beijing National (i.e., global IPID assignment and per-destination IPID assign-
Research Center for Information Science and Technology (BNRist), Depart- ment) [7], [16]–[19], Linux currently assigns IPID to packets
ment of Computer Science and Technology, Tsinghua University, Beijing based on a mixed method [20]–[22]. If a packet is generated
100084, China (e-mail: [email protected]; fcp20@mails.
tsinghua.edu.cn; [email protected]). from socket protocols such as TCP, Linux uses the per-socket-
Qi Li is with the Beijing National Research Center for Information Science based IPID assignment policy that assigns IPID to the packet
and Technology (BNRist), Institute for Network Sciences and Cyberspace, based on the counter recorded in the protocol socket. Other-
Tsinghua University, Beijing 100084, China (e-mail: [email protected]).
Kun Sun is with CSIS, Department of Information Sciences and Technology, wise, Linux adopts the hash-based IPID assignment policy that
George Mason University, Fairfax, VA 22030 USA (e-mail: [email protected]). assigns IPID based on one of the 2048 globally shared hash
Digital Object Identifier 10.1109/TNET.2021.3115517 counters. In practice, Linux uses the DF (Don’t Fragment)
1558-2566 © 2021 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission.
See https://www.ieee.org/publications/rights/index.html for more information.
410 IEEE/ACM TRANSACTIONS ON NETWORKING, VOL. 30, NO. 1, FEBRUARY 2022
flag in packet header [14] to choose between the two poli- within 215 seconds on average and the success rate is
cies, since only socket protocols can set this flag to TRUE over 88%.
to perform the path MTU discovery (PMTUD) mechanism Note that the attacks in IPv4 networks require that the off-
[23], [24]. In other words, if the DF flag is set to TRUE, path attackers control 1,837 IPv4 addresses on average to
it uses the per-socket-based policy; otherwise, it chooses the construct hash collisions and build the side channel. However,
hash-based policy. However, our study shows that the mixed this requirement may not be easily fulfilled in the IPv4 net-
IPID assignment in Linux implementations has vulnerabilities works for individuals. We resolve this limitation by exploiting
that can be exploited to launch a new off-path TCP hijacking IPv4/IPv6 dual-stack networks that hold adequate IP addresses
attack. to build the side channel. Particularly, for Linux systems
Since Linux uses the more secure per-socket-based IPID running IPv4/IPv6 dual-stack, we show that attackers can more
assignment by default for TCP connections, an off-path easily construct hash collisions by leveraging the adequate
attacker first tricks the victim into assigning IPID for its TCP IPv6 addresses. Since the globally shared 2048 hash counters
packets using the less secure hash-based IPID assignment. This on the victim are also used by IPv6 addresses [22], an off-path
goal can be achieved by pretending to be a router and sending attacker can misuse its adequate IPv6 addresses to construct
a forged ICMP “Fragmentation Needed” error message [25] hash collisions and identify the target hash counter used in a
to a victim. Since the ICMP error message informs the victim victim TCP connection. Hence, in IPv4/IPv6 dual-stack net-
that the packets issued from the victim need to be fragmented works, the off-path attacker can more easily hijack victim TCP
and the DF flag is set, the victim will be tricked into cleaning connections between the vulnerable server’s IPv4 interface and
the DF flag of TCP packets and thus uses the hash-based IPID an arbitrary IPv4 client.
assignment. Next, the victim chooses one IPID counter from Finally, we propose countermeasures that aim to eliminate
the 2048 hash counters to assign IPID for its TCP packets. the root cause of the newly discovered off-path TCP attack.
Among the 2048 globally shared hash counters, the target We fix the mixed IPID assignment in Linux kernels by
counter is decided by the hash value of four components, determining if a packet is originated from TCP protocol
i.e., three fields of the packet (source IP address, destination on the Protocol field in IP header, instead of the DF
IP address, protocol number) and a random value generated flag. We implement a prototype of our countermeasure in
on system boot. Due to the small-sized hash counter pool, Linux 4.18 and confirm its effectiveness through experimental
the attacker may identify the target hash counter used in a evaluation on the Internet.
victim TCP connection via hash collisions, namely, alternating Contributions: Our main contributions are the following:
IP addresses to collide with the target counter. • We uncover that the new mixed IPID assignment method
Once the shared IPID counter is known, attackers can use can still be exploited to hijack TCP connections.
the challenge ACK mechanism [6] as trigger conditions to • We uncover a new side channel in IPID assignment in the
change the shared IPID counter, facilitating the next two attack latest Linux kernels. We demonstrate that the side channel
steps, i.e., to detect the presence of the victim TCP connection can be exploited to learn the presence of victim TCP
and infer the sequence and acknowledgment numbers. The connections and infer the sequence and acknowledgment
attacker sends forged TCP packets to the victim, and the numbers of the connections.
triggered challenge ACK packets will alter the shared IPID • We discover that more than 20% of Alexa top 100k websites
counter under different situations. It helps the attacker to are vulnerable to our off-path attack. We also perform case
determine if the specified values in the forged TCP packets studies on a wide range of applications and confirm the
are correct. Note that our attack only leverages the challenge effectiveness of the attack.
ACK mechanism as trigger conditions to assist the inference • We analyze the root cause of the new attack and develop
of a victim TCP connection, instead of directly exploiting countermeasures that use new IPID assignment methods
vulnerabilities in the challenge ACK mechanism to hijack TCP for TCP packets. Our prototype in Linux 4.18 validates its
connections [8], [9]. effectiveness.
Our attack does not suffer from traditional noise challenges
that other works have to address [16], [17], [26], [27]. Since, II. BACKGROUND
in our attack, irrelevant TCP traffic using per-socket-based
counters, instead of the hash-based counters, will not interfere A. IPID Assignment in Linux
with the attack traffic. Moreover, we measure that non-TCP There are two basic IPID assignment policies in current
traffic also rarely interferes with the attack. We evaluate the Linux, i.e., IPID based on 2048 hash counters or IPID
impacts of the new off-path TCP vulnerability on the Internet. based on per-socket counters, where the latter is specific to
We find that more than 20% of the Alexa (www.alexa.com) socket related protocols such as TCP. Figure 1 illustrates
top 100k websites are vulnerable to our off-path attack. the procedure of IPID assignment in Linux version 4.18 and
Those websites can be tricked into cleaning the DF flag and beyond. When a packet is generated, the IP protocol first
downgrading the IPID assignment from the per-socket-based checks whether the packet is a TCP RST packet. If yes, then
policy to the hash-based policy for their TCP packets after the IPID of the packet is set to 0 directly. This assignment
receiving forged ICMP “Fragmentation Needed” messages. is due to Geoffrey et al.’s disclosure of a side channel in
We implement a PoC and perform case studies on a wide range previous assignment methods, i.e., IPID of the RST packet
of applications, e.g., HTTP, SSH and BGP, to validate the was assigned based on one of the 2048 hash counters before
effectiveness of the attack in the real world. The experimental version 4.18, which can be exploited to detect the presence of
results show that our off-path TCP attack can be constructed TCP connections [21].
FENG et al.: OFF-PATH TCP HIJACKING ATTACKS VIA SIDE CHANNEL OF DOWNGRADED IPID 411
to the carried next-hop MTU value in the message. The

originator repeats the sending process until a packet with
certain size could be forwarded to the destination, and it then
sets the size as PMTU.
However, during this procedure, if an intermediate router’s
next-hop MTU is smaller than the originator’s acceptable min-
imum PMTU min_pmtu that is a system variable in PMTUD
implementations, the originator will resize the packet size to
min_pmtu, clear the DF flag of subsequent packets, and then
send them out. In RFC 1191 [23], min_pmtu is recommended
Fig. 1. IPID assignment in Linux version 4.18 and beyond. as 576 octets. However, it varies in different implementations,
e.g., 256 octets in FreeBSD, 296 octets in Mac OS, 552 octets
in Linux, and 596 octets in Windows.
If the packet is not a TCP RST packet, IP protocol checks In most PMTUD implementations, hosts do not validate
the DF flag of the packet. IF the DF flag is set to FALSE, the source and transmission path of ICMP “Fragmentation
the IPID will be assigned based on a hash counter. There are Needed” messages (e.g., Linux kernel version 3.9 and beyond).
totally 2048 hash counters in Linux. IP will select one from Therefore, an off-path attacker can pretend to be a router and
these counters according to the hash value of 4 variables, forge such an ICMP message specified with an extremely
i.e., source IP address and destination IP address of the small next-hop MTU value. Actually the specified next-hop
packet, the protocol number of the packet, and a random value MTU value can be even set to 68 octets, the minimum of
generated on system boot. After the IPID value is copied from PMTU value on the Internet. After sending such a forged
the selected counter, the counter will increase by a uniform ICMP message to the originator, if the embedded packet in
distribution value between 1 and the number of system ticks the forged ICMP message can pass the originator’s check,
since the last packet transmission that used the same counter. the originator will be tricked into clearing the DF flag, thus
The system tick is usually measured in milliseconds. downgrading the IPID assignment for TCP packets. According
When the DF flag is set to TRUE, except for the TCP to RFC 792 [25], the forged ICMP message should embed at
SYN/ACK (both the SYN flag and the ACK flag in TCP header least 28 octets data to pass the originator’s check. We will
are set to TRUE) packet whose IPID is assigned to 0, IP assigns show that an ICMP echo reply packet can be embedded in the
IPID for other packets based on the second policy that is based forged ICMP message to deceive the originator’s check.
on a per-socket counter unique to each connection. The per-
socket counter is usually initialized to a random value. Then
each time after a packet is transmitted using this counter, C. Challenge ACK Mechanism
the counter increases by 1. The per-socket-based assignment To defeat blind in-window attacks on TCP, the challenge
policy is considered to be more secure and can avoid being ACK mechanism was proposed as RFC 5961 [6]. In a nutshell,
observed from off-path attackers. Since the DF flag of TCP the challenge ACK mechanism requires that the sender of
packets is be default set to TRUE to enable the path MTU packets triggering the challenge conditions replies with the
discovery mechanism, TCP packets follow this per-socket exact sequence number, not just one within the receive win-
assignment policy. Through studying the IPID assignment in dow. Thus, it can prevent an off-path attacker’s blind injection
Linux, we find that if the DF flag of TCP packets can be unless the attacker is extremely lucky to be able to guess
cleared (i.e., set to FALSE), then the IPID assignment to TCP the exact sequence number with a probability of 1/232 . The
packets will be downgraded from using the per-socket-based challenge ACK mechanism is designed to enhance the security
policy to the hash-based policy. of TCP; however, we show that it can be abused to infer the
state of a victim TCP connection.
B. Path MTU Discovery Our attack exploits the challenge conditions in three aspects.
First, if a receiver1 sees an incoming SYN segment, regardless
To avoid IP fragmentation, RFC 1191 [23] and
of the sequence number in the segment, it sends back an
RFC 1981 [24] propose a mechanism to discover path
challenge ACK to the sender to confirm the loss of the previous
MTU (PMTU) between two end hosts, i.e., the minimum
connection. Only the legitimate remote peer will send a RST
of all hops’ MTUs in the entire packet transmission path.
segment with the correct sequence number (derived from the
PMTUD relies on the DF flag. Before sending a packet,
ACK field of the challenge ACK packet) to prove that the
the originator sets the DF flag of the packet to TRUE,
previous connection is indeed terminated. Off-path attackers
indicating that the packet is not allowed to be fragmented by
cannot answer this challenge with correct sequence number.
intermediate routers. If the packet exceeds a router’s next-hop
We will show that this challenge condition can be abused to
MTU, the intermediate router discards it and issues an ICMP
detect victim TCP connections.
Destination Unreachable message (type 3) to the originator
Second, when a receiver sees an incoming RST seg-
with the code Fragmentation Needed and DF set (code 4) in
ment, if the carried sequence number is outside the receive
IPv4 or an ICMPv6 Packet Too Big message in IPv6, along
window, the receiver simply discards the segment. Instead,
with the router’s next-hop MTU value carried in the ICMP
message. After receiving the ICMP message, if the embedded 1 TCP is a full duplex protocol, hence the receiver may be the server peer
packet in the message passes the originator’s check, then the or the client peer of the connection. We use the receiver here to refer to the
originator reduces the size of subsequent packets according peer that receives an incoming TCP segment.
server. Then, by observing the change of the shared IPID

counter, the attacker can determine the correctness of the
specified source port number in the spoofed SYN/ACK packets
and thus detect the presence of the TCP connection between
the server and the victim client.
Step 3: Inferring Sequence and Acknowledgment Num-
bers. After a victim TCP connection is identified, the attacker
Fig. 2. Threat model. sends spoofed RST packets and ACK packets to the connec-
tion, and triggers challenge ACK mechanism on the connec-
tion. By observing the changes of the shared IPID counter,
if the sequence number is in-window but does not exactly
the attacker can determine the correctness of the specified
match the expected next sequence number (i.e., RCV.N XT ),
sequence number and acknowledgment number in the forged
the receiver will send a challenge ACK to the sender to confirm
packets.
the reset action. We will show that this challenge condition can
After correctly identifying the sequence numbers and
be abused to judge the correctness of the guessed sequence
acknowledgment numbers of the victim connection,
number.
the attacker can forge malicious TCP segments with the
Third, if a receiver sees an incoming ACK segment,
identified values and inject the segments into the victim
it validates the acknowledgment number of the seg-
connection to either reset the connection or poison the data
ment (SEG.ACK) with a window of SN D.U N A −
stream. In the next three sections, we will detail the above
SN D.M AX.W N D <= SEG.ACK <= SN D.N XT ,
three steps.
where SN D.U N A is the sequence number of the first
unacknowledged octet, SN D.M AX.W N D is the maximum IV. D ETECTING V ICTIM C LIENTS
window size that the receiver has ever seen from its peer. The
receiver considers that the acknowledgment number is legal A. Downgrading the IPID Assignment
and accepts it if the acknowledgment number is in this range. Linux assigns IPID for packets based on the DF flag. If the
If SEG.ACK is in the range of [SN D.U N A − (231 − 1), DF flag is set to TRUE, Linux will assign IPID for the packet
SN D.U N A − SN D.M AX.W N D], i.e., the challenge ACK based on a per-socket IPID counter; otherwise, based on a
window, the receiver responds with a challenge ACK packet. hash IPID counter. However, we observe that the DF flag can
We will show this challenge condition can be abused to judge be maliciously cleared by off-path attackers, thus downgrading
the correctness of a guessed acknowledgment number. the IPID assignment. The attacker pretends to be a router and
sends a forged ICMP “Fragmentation Needed” message to the
III. ATTACK OVERVIEW victim server, indicating that a router between the server and
the client has a smaller next-hop MTU and the packet is not
A. Threat Model allowed to be fragmented.
Figure 2 illustrates the threat model of our off-path TCP In order to trick the server into accepting the forged ICMP
exploit. It involves three hosts, i.e., a victim client, a victim “Fragmentation Needed” message and clearing the DF flag
server, and an off-path attacker. The server and the client of TCP packets sent to the client, the forged ICMP message
communicate based on a TCP connection, while the off-path needs to satisfy two conditions. First, the server does not
attacker aims to hijack the connection. The off-path attacker validate the source of the ICMP message, i.e., the forged ICMP
cannot eavesdrop the traffic transferred between the server and message from off-path attackers will not be discarded by the
the client as the man-in-the-middle attacker does. However, server. In practice, the validation requires extra functionality
the attacker is capable of sending spoofed packets with the IP support from hardware devices [29], since major OSes, e.g.,
addresses of the server and the client. This capability assump- Linux 3.9 and beyond, do not perform the validation but
tion is practical, since at least a quarter of the Autonomous directly accept the message. Second, the data embedded in
Systems (ASes) on the Internet do not filter packets with the forged ICMP message must be able to evade the server’s
spoofed source addresses leaving their networks [28]. checks. RFC 792 [25] states that ICMP error messages should
be embedded at least 28 octets (i.e., the IP header plus at least
the first 8 octets) of the triggering packet, which is used by
B. Attack Procedure the server to match the message to the appropriate process.
Our off-path TCP exploit consists of three main steps to Moreover, according to the newer standard RFC 1812 [30],
hijack a victim TCP connection. ICMP error messages should be embedded as much of the
Step 1: Detecting Victim Clients. The attacker downgrades triggering packet as possible, but not exceeding 576 octets.
the server’s IPID assignment from the per-socket-based pol- Hence, the attacker has to craft and embed feasible data into
icy to the hash-based policy. Then, through hash collisions, the forged ICMP error message to evade the server’s check.
the attacker detects victim clients who share the same IPID To evade the server’s check, we can embed the ICMP echo
counter with the attacker on the server side, i.e., the server reply data into the forged ICMP “Fragmentation Needed”
uses the same hash-based IPID counter to assign IPID for TCP message, as shown in Figure 3. When servers equipped with
packets to the victim client and for packets to the attacker. Linux 3.9 and beyond receive such an ICMP “Fragmentation
Step 2: Detecting TCP Connections. Once a poten- Needed” message embedded with an echo reply, the server
tial victim client is detected, the attacker impersonates the does not check whether it sent the embedded echo reply data
victim client and sends spoofed SYN/ACK packets to the earlier. Instead, it directly responds to the forged ICMP error
between the server and the detected client. Our attack uses the
ICMP protocol to detect hash collisions due to its simplicity
and observability.
The procedure of detecting victim clients by constructing
hash collisions is shown in Figure 4. First, the attacker pre-
tends to be a router and sends a forged ICMP “Fragmentation
Needed” message to the server, who will be tricked into
clearing the DF flag and downgrading the IPID assignment
of packets to the client whose IP address is specified in the
forged ICMP message. Second, the attacker initiates ICMP
echo requests to the server and observes the IPID of the reply
packets. Then the attacker impersonates the client and sends
a spoofed SYN packet to the server’s listening port (e.g., 80).
Following the three-way handshake process of TCP, the server
will respond an SYN/ACK packet to the client. Here, the key
difference is that if the attacker’s IP address collides with the
Fig. 3. Structure of the forged ICMP error message.
client (i.e., the attacker and the client share the same hash-
based IPID counter at the server side), the IPID assignment for
message and clears the DF flag of subsequent packets sent to the SYN/ACK packet will incur an additional increment to the
the client whose IP address is specified in the embedded echo shared IPID counter, which can be observed by the attacker.2
reply. Even if the server checks on the embedded echo reply Otherwise, if there is no collision, the IPID observed by the
data, it is easy for attackers to circumvent this checking. For attacker will be continuous distribution, i.e., without additional
example, the attacker can impersonate the client and initiate increment. Using this method, the attacker can identify victim
an ICMP echo request to the server, triggering the server clients who collide with its IP address and share the same
to send an echo reply message. Then, the attacker pretends IPID counter.
to be a router and sends an ICMP “Fragmentation Needed”
message embedded with the known echo reply data to the hash(server_IP, client_IP, T CP, Boot_key)
server, tricking the server into accepting the forged message. = hash(server_IP, attacker_IP, ICM P, Boot_key) (1)
Note the next-hop MTU value specified in the forged ICMP
“Fragmentation Needed” message should be smaller than the The hash-based IPID counter does not increase linearly.
server’s acceptable minimum PMTU min_pmtu, as described Instead, the increment is a random value in a uniform distrib-
in Section II-B. Actually, the value can be set to 68 octets, ution between 1 and the number of system ticks since the last
which is always smaller than the system variable of min_pmtu packet transmission that used the same counter. Hence, if the
in various IP implementations. Besides, we find that a forged attacker wants to force the counter to increase linearly and
ICMP error message embedded with a GRE data [31] can also facilitate the observation, it needs to restrict the increment of
be used to trick the server into clearing the DF flag. system ticks related to the IPID counter. Usually, if more than
In a nutshell, it is difficult to verify the legitimacy of ICMP 3 packets are sent to the server under 10 ms, the random value
error messages on the Internet. Therefore, an attacker can forge added to the IPID counter will never be larger than one [21].
an ICMP message and trick the server into accepting it. The We send ICMP request packets to the server in parallel and
forged ICMP error messages can force the server to clear the restrict the increment of system ticks. Our experiments show
DF flag of packets sent to the victim client. Thus, the IPID that if the round-trip time (RTT) from the attacker to the server
assignment can be easily downgraded by attackers. is within 200 ms, the attacker only needs to send less than
300 packets per second to force the hash-based IPID counter
increasing linearly.
B. Constructing Hash Collisions There are totally 2048 hash-based IPID counters in Linux,
The server will assign IPID to the packets by using and the probability of hash collisions between the attacker
one of 2048 hash counters once the TCP packet’s DF flag and the client is a geometric distribution. When the protocol
is cleared. The counter is selected based on four factors, is specified as ICMP (see Eq. 1), if the attacker has k IP
i.e., source IP address, destination IP address, protocol num- addresses, the probability of collisions between the attacker
ber (e.g., 1 represents ICMP protocol, 6 represents TCP and the target client is 1 − (1 − p)k , where p equals 1/2048.
protocol) of the packet, and a random value generated on To construct an attack in practice, the attacker has two strate-
system boot. A hash index computed from the four factors is gies to detect victim clients by leveraging hash collisions.
used to select one counter from the 2048 hash IPID counters. Attacking Potential Targets: If the attacker has only one or
Hence, if the TCP packets sent to the victim client have the a few IP addresses, the attacker can detect potential victim
same hash value as the packets sent to the attacker, the server clients who collide with the attacker. In theory, if the attacker
will use the same IPID counter to assign IPID for those has only one IP address, on a target server, the number of
packets to different destinations. Therefore, by constructing
2 A special case is that the source port in a spoofed SYN packet happens to
hash collisions using Equation 1, the attacker can detect the
victim clients who share the same IPID counter on the server match the source port of a TCP connection from the client to the server. In this
case, the spoofed SYN packet will trigger a challenge ACK packet, instead of
side. In other words, the shared IPID counter forms a side a SYN/ACK packet. However, the attacker can still observe an additional
channel, which can be exploited to infer TCP connections increment to the shared IPID counter.
Fig. 4. Detecting potential victim clients through hash collisions.
clients conflicting with the attacker is 232 /2048 = 221 . Since V. D ETECTING TCP C ONNECTIONS
the detection only depends on the server side, the attacker
can create a list of IP addresses and select one from the list Once a victim client is identified, the attacker can learn
as the client’s IP address each time. Following the procedure the presence of TCP connections between the client and
in Figure 4, the attacker can determine if the selected one is the server. A TCP connection is identified by a four-tuple,
a victim. In this way, the attacker can identify and enumerate i.e., [source IP address, source port number, destination IP
all the potential victim clients who are vulnerable to its address, destination port number]. Usually, the destination IP
IP address. In our test, an attacker can detect more than address, and port number are public known, so an attacker
20 victim clients within 6 minutes using one IP address only needs to infer the source IP address and source port
(see Section VII-A). number. In our attack, since the victim client can be detected
Attacking Arbitrary Targets: If the attacker has enough by using hash collisions, the only missing tuple is the source
number of IP addresses, it can attack arbitrary TCP con- port number.
nections by alternating its IP addresses to generate the hash Assuming that a TCP connection from source port y has
collision. According to the geometric probability distribution, been established earlier by a legal user in the victim client,
if the attacker has more than 2048 IP addresses, it can collide an off-path attacker can identify this port number by sending
with any clients with above 63.2% probability. Especially, for out probing packets. First, the attacker continuously sends
servers running IPv4/IPv6 dual-stack, attackers can use ade- ICMP echo request packets to the server and observes the IPID
quate IPv6 addresses to construct hash collisions with arbitrary values of the reply packets from the server. Then, the attacker
target clients, since both IPv4 and IPv6 addresses share the impersonates the victim client and sends a forged SYN/ACK
same 2048 hash-based IPID counters (see Section VII-D for packet with a guessed source port number to the server. If the
implementations and evaluations of our attack in dual-stack source port number specified in the SYN/ACK packet does not
networks). equal y, according to the TCP specification [1], the server will
The detected hash-based IPID counter shared with the respond a RST packet to the client. Due to the patch fixing the
victim client is stable. That is, if the server does not vulnerability identified by Alexander et al. [21], Linux kernel
restart (i.e., the Boot_key in Eq. 1 is not altered), versions 4.18 and beyond assign an IPID of 0 to the RST
the client’s TCP connection will always share this IPID packet, which will not incur an increment to the shared IPID
counter with the attacker. In practice, servers (e.g., web counter. Hence, the IPID values in the reply packets observed
servers and BGP routers) do not restart frequently. Hence, by the attacker are continuous.
the attacker can detect shared IPID counters and victim If the guessed source port number specified in the forged
clients in advance, regardless of if TCP connections have been SYN/ACK packet equals y, the challenge ACK mechanism [6]
established. makes the server send a challenge ACK packet to the victim
Note Linux assigned IPID to RST packets based on hash client for confirming the legitimacy of the SYN/ACK packet.
counters before version 4.18, and thus an attacker can observe The IPID in the challenge ACK packet will be assigned based
its IPID distribution to determine if it shares the same counter on the shared IPID counter, which will incur an additional
with the client by spoofing SYN/ACK packets [21]. This increment to the counter. Thus, from the view of the attacker,
vulnerability has been fixed since Linux 4.18 by always setting the IPID values in the reply packets from the server will not
the IPID of RST packets to 0, incurring no changes on any be continuous.
IPID counters. However, we find that after the critical step of The attacker repeats the above procedure, i.e., changing
downgrading the IPID assignment, an attacker can still detect the source port number specified in the forged SYN/ACK
hash collisions through forging SYN packets and triggering the packet and then observing the IPID of the reply packets,
server to respond SYN/ACK packets and then identify a victim until the correct port number y is identified. Finally, the TCP
client. Moreover, we will show that the fix of assigning 0 to connection running on the identified four-tuple is all known
RST packets introduces yet another vulnerability, which can to the attacker. In practice, the attacker can adopt a parallel
be exploited by a pure off-path attacker to detect the presence approach to facilitate the identification of the source port,
of victim TCP connections (see Section V). i.e., to search the source port number by sending multiple
probing packets in a certain range during a period. If the attacker impersonates the victim client and sends a spoofed
source port is in the range, the shared IPID counter will have ACK packet with a guessed acknowledgment number ack to
an additional increment, so the attacker can further narrow the the server, the packet is also specified with an acceptable
range. Otherwise, the attacker can detect another port range in sequence number detected previously. If ack is in the challenge
parallel. In addition, the attacker can use a binary-search-like ACK window of the server, a challenge ACK packet will be
algorithm [8], [9] to further reduce the detection time cost. issued, incurring an additional increment to the shared IPID
counter. Instead, if ack is not in the challenge ACK window,
VI. I NFERRING S EQUENCE AND the observed IPID will be continuous from the view of the
ACKNOWLEDGMENT N UMBERS attacker. In practice, the challenge ACK window size is always
between 1G and 2G [8], [9], [32], i.e., one quarter of the
A. Inferring Acceptable Sequence Number
entire acknowledgment number space. Hence, to facilitate the
To infer the acceptable sequence numbers on the server detection, the attacker can divide the entire space into 4 blocks
side, the attacker continuously sends ICMP request packets to and probe each block to check which block the challenge ACK
the server and observes the IPID values of the reply packets. window falls in.
Then, the attacker impersonates the victim client to send a
spoofed RST packet to the server. The RST packet is specified
with the guessed sequence number seq. We need to consider C. Detecting the Exact Sequence Number
two cases: (i) seq not in the server’s receive window and Now we present the method of detecting the exact sequence
(ii) seq in the server’s receive window. According to the number (i.e., RCV.N XT , the lower boundary of the server’s
challenge ACK mechanism described in Section II-C, in the receive window) based on the previous inferred results. The
first case, the server will discard the spoofed RST packet attacker can forge multiple ACK packets with a constant
directly, so it does not influence the shared IPID counter. acknowledgment number ack_challenge in the challenge ACK
In the second case when the guessed seq is in the server’s window and the specified sequence number in each ACK
receive window, the server will respond to this RST packet and packet set to seq_acceptable − i, where seq_acceptable is
send a challenge ACK packet to the victim client to confirm an acceptable sequence number inferred previously. Then the
the legitimacy of the packet. The IPID of this challenge ACK attacker impersonates the victim client to send these forged
packet is assigned based on the shared IPID counter, and it ACK packets to the server. In the beginning, the server will be
will incur an additional increment to the counter. The attacker triggered to send challenge ACK packets at a rate of one packet
can observe the increment and then determine that the guessed per 500 ms due to the rate limit of challenge ACK, so the
seq is located in the server’s receive window.3 triggered challenge ACK packets will incur regular increments
In practice, in order to reduce the time cost of sequence to the shared IPID counter. However, once the specified
number inference, the attacker can divide the sequence number sequence number seq_acceptable−i reaches RCV.N XT (the
space into multiple blocks whose sizes are equal to the default lower boundary of the server’s receive window), the server will
receive window size in Linux (87380 octets), probing only switch to send duplicate ACK packets, which is not enforced
once per block. Besides, the attacker can apply parallel search by any rate limit. Thus, the shared IPID counter will have
methods similar to those used in connections detection to a jitter,4 and the attacker can observe this jitter and then detect
further reduce the time cost. the exact sequence number. The detecting procedure has no
side effects, e.g., resetting the connections, on the connections.
B. Locating the Challenge ACK Window
According to RFC 5961, when a segment arrives at the D. Detecting Acceptable ACK Number
server, the server also checks the segment’s acknowledgment
Once an acknowledgment number ack_challenge in the
number even if its sequence number is in the server’s receive
challenge ACK window is identified, the attacker can also
window. There are three cases in the whole acknowledgment
detect the boundary of the challenge ACK window by sending
number space: (i) the acknowledgment number in challenge
multiple probing ACK packets and then observing the shared
ACK window, (ii) in the acceptable ACK range, and (iii) invalid
IPID counter, similar to detecting the lower boundary of the
acknowledgment numbers. In the first case, the server will
server’s receive window. The forged probing ACK packets are
issue a challenge ACK packet to confirm the legitimacy of
specified with a constant sequence number seq_acceptable,
the triggering segment. In the second case, the server will
and the acknowledgment number of each ACK packet is set
accept the segment directly. Otherwise, if the segment carries
to ack_challenge − i. In turn, the attacker sends these forged
an invalid acknowledgment number, the server will discard it
ACK packets to the server. Challenge ACK packets will be
silently. The last two cases cannot be differentiated directly
triggered until ack_challenge − i reaches the lower boundary
because it cannot be observed from an off-path attacker.
of the challenge ACK window. Once this boundary is detected,
However, the attacker can first identify the challenge ACK
then SN D.U N A can be easily inferred, i.e., adding 2G to
window of the server and then infer the acceptable ACK
the detected boundary. SN D.U N A is in the acceptable ACK
numbers.
range. When all the data sent earlier has been acknowledged,
When locating the challenge ACK window, the attacker
SN D.U N A equals SN D.N XT . Instead, if the server has an
observes and records the shared IPID counter. Then the
amount of data to be sent to the client, SN D.N XT can also
3 In a special case when seq exactly matches the server’s RCV.N XT ,
the server will reset the connection directly. However, the probability of this 4 The increments to the shared IPID counter become 20 per 500 ms in our
case occurring is 1/232 , which is negligible. experiments, instead of 1 per 500 ms.
be inferred by adding the typical size of the send window to TABLE I

SN D.U N A, e.g., 16384 octets in Linux by default. D ETECTING V ICTIM C LIENTS U SING O NE IP A DDRESS
VII. I MPLEMENTATION AND E VALUATION

Ethical Considerations: In order to avoid causing real
damages or negative impacts on the Internet, we choose not to
directly attack real users and their hosts. All the hosts involved
in the experiments are our machines. We evaluate the impacts
of our off-path TCP attacks on the Internet, e.g., measuring
Alexa top 100k websites to identify potential victim servers
that are vulnerable to our attack. However, we do not exploit
the vulnerability of these web servers for real attacks.
In this experiment, we select different target clients and repeat

A. Identifying Victim Clients the detecting process 200 times. The empirical cumulative
We show two scenarios of identifying victim clients via hash distribution function (CDF) of the time cost and the number of
collisions after downgrading the server’s IPID assignment. required attacker IP addresses are shown in Figure 5. For an
First, we show how to detect potential victim clients using one arbitrary target client, the average time cost to detect a correct
IP address. Second, we illustrate that the attacker can attack IP address in the attacker’s address pool is 15.4 seconds, and
arbitrary victim clients if having enough IP addresses. the number of IP addresses needed is 1,837 on average. Fur-
Experimental Setup: Two types of hosts are used in this thermore, after spending 24 seconds to check 3,000 addresses,
experiment. A server listening on port 80 and waiting for TCP the attacker has a probability of 80.0% to identify a correct
connection requests is equipped with Ubuntu 18.04 (kernel IP address that can be used to attack an arbitrary client.
version 5.5) with a prefix of 152.136.0.0/16. Attack machines The measured probability is higher than the theoretical one,
locate in different positions with independent IP addresses. i.e., 1 − (1 − 1/2048)3000 ≈ 76.9%.
We use these IP addresses to detect victim clients to the To evaluate the threats of our off-path TCP attack on the
server. The attack machines are equipped with Ubuntu 18.04 Internet, we measure Alexa top 100k websites to identify
(kernel version 4.15) and are able to send packets to the server how many websites suffer from the vulnerable IPID assign-
with spoofed IP addresses. ment. We observe that 22,953 websites are vulnerable to
Results With One Attacker IP Address: When having only forged ICMP “Fragmentation Needed” messages from off-
one IP address, an attacker can detect more than 2 million path attackers and thus can be tricked into clearing the DF
victim clients to the server. In this scenario, we deploy flag of TCP packets and downgrading the IPID assignment.
one attack machine and assign IP address from a target These websites are vulnerable to our attack. We cannot
IP list, which contains several prefixes owned by different confirm the effectiveness of the attack against 22,803 websites
organizations. The attack machine clears the DF flag of the that are unreachable from our vantage point in California.
server’s TCP packets to IP addresses in these prefixes via The unreachability of these websites is mainly caused by
forging ICMP “Fragmentation Needed” messages, and then censorship [33] and ISP filter rules [34]. Moreover, we suspect
it scans the target prefixes to identify potential victim clients that the rest resist to our attack due to two reasons, i.e., the OS
that share the same hash-based IPID counter with the attack versions of the websites are invulnerable (e.g., old Linux ker-
machine on the server. The experimental results are shown nel versions or Windows), or the forged ICMP error messages
in Table I. By using only one attack machine (i.e., one attacker are blocked.
IP address), the attacker can detect a considerable number of
potential victim clients in different organizations. For instance,
as shown in the last row of Table I, the number of victim B. TCP DoS Attacks
clients that collide with the attack machine are 179 in the Experimental Setup: This attack involves 3 hosts, namely,
prefixes of 3.208.0.0/12 (owned by Amazon). The time costs an SSH server equipped with Ubuntu 18.04 (kernel version
of identifying these victim clients are 30.0 minutes, i.e., it 4.18 or beyond), OpenSSH 7.6 and OpenSSL 1.0.2, a victim
takes 10.1 seconds on average to detect a victim client. The client who accesses the server based on SSH connections, and
average outbound traffic of the attack machine is 125.14 KB/s an attack machine equipped with Ubuntu 18.04 (kernel version
(i.e., around 584 packets/s). Thus, it is difficult to detect 4.15) and a prefix of 152.136.0.0/16 that contains 2000 IP
the malicious probing, e.g., by leveraging network traffic addresses in this prefix. The attack machine can use these IP
monitoring systems. addresses to detect hash collisions with the target client. The
Results With Multiple Attacker IP Addresses: When the attacker attempts to reset the connection via sending TCP RST
attacker has multiple IP addresses, it aims to attack an arbitrary packets to the server.
client to the server using these IP addresses. After selecting Attack Procedure: In this attack, the 3-tuple [client IP
the target client, the attacker clears the DF flag of the server’s address, server IP address, server port] is known. First,
TCP packets to the client by forging an ICMP “Fragmentation the attacker identifies an IP address in its prefix which collides
Needed” message. Then, the attacker detects addresses in with the client IP address. Second, based on the identified
its address pool to find a correct one that collides with the attacker IP address, the attacker infers the correct client port
target client, i.e., sharing the same hash-based IPID counter. number and the exact sequence number (RCV.N XT on the
Fig. 5. Empirical CDF of time cost and the number of attacker IP addresses needed to detect a hash collision.
TABLE II
E XPERIMENTAL R ESULTS OF SSH C ONNECTION R ESET
server side) of the victim SSH connection. Finally, a spoofed

RST packet specified with the inferred value is sent to the
server, and the server will be tricked into resetting the SSH
connection from the victim client. In this attack, the acceptable Fig. 6. Time/Bandwidth overheads of web manipulation.
acknowledgment numbers are not needed.
Experimental Results: On average, the time cost of iden-
tifying a correct attacker IP address is 15.4 seconds, and into the chatting group. Here, the server IP address and server
the correct one will be identified after checking 1,837 IP port are publicly known.
addresses on average. Table II illustrates our experimental Attack Procedure: The attacker first downgrades the server’s
results. We test the attack against 4 servers that are equipped IPID assignment and detects potential victim clients who share
with Linux kernel version 4.19, 4.20, 5.3, and 5.5, respec- the same hash-based IPID counter with the attacker. Next,
tively. The diversity of servers ensures the feasibility and the attack can be constructed in the following four steps:
effectiveness of the attack. The average time cost of resetting (1) detecting whether the client has a TCP connection to the
an SSH connection is 155 seconds, and the success rate is over server, i.e., identifying correct source port number to obtain
88%. TCP connections DoS attack is particularly applicable to the TCP 4-tuple information, (2) inferring the exact sequence
compromising applications secured by encrypted traffic, e.g., number, i.e., RCV.N XT on the server, which can slide the
HTTPS and SSH. server’s receive window, leading to that the segment can be
delivered to HTTP immediately, (3) inferring the acceptable
acknowledgment numbers, and (4) injecting forged segments
C. TCP Manipulation Attacks specified with the inferred values into the server and pushing
In this case, we perform two attacks to demonstrate that fake messages into the chatting group.
the newly discovered IPID side channel can be exploit to Experimental Results: It takes 14.0 seconds to detect a
manipulate a TCP connection maliciously, thus causing serious potential victim client and 35.4 seconds to identify the cor-
damage to the upper applications including HTTP and BGP. rect source port number of the TCP connection. Figure 6
(1) Manipulating Web Traffic: We demonstrate that under shows that the time cost in inferring the acceptable sequence
the typical web application scenario, an off-path attacker can numbers, locating the challenge ACK window, detecting the
detect a victim client connecting to the target web server and exact sequence number and an acceptable acknowledgment
then hijack the connection between the server and the client. number are 123.8 seconds, 0.7 seconds, 18.7 seconds and
Experimental Setup: This attack involves 3 hosts. A web 14.0 seconds, respectively. On average, the overall time cost
server is equipped with Linux kernel version 5.5 and a of this attack is 206.6 seconds, including the time cost of
popular real-time communication web application called detecting the victim client that can be performed in advance.
Rocket.Chat [35]. An attack machine is equipped with Ubuntu 64.3% of the overall time is spent on inferring the acceptable
18.04 (kernel version 4.15), and it is able to send packets to sequence numbers. The reason is that the server’s receive
the server with a spoofed IP address. A client can access the window is relatively narrow and the attacker must sample
web server based on HTTP. Note the OS type or version of a large number of sequence numbers. The average band-
the client is unrestricted in our attack. The attacker attempts width overhead of this attack is 23.55 KB/s. When detecting
to identify the potential victim client and hijack the TCP acceptable ACK numbers, the probing packets are padded
connection between the server and the client. For instance, with crafted application data, hence they consume a large
the attacker may impersonate the victim client to inject mali- portion of the bandwidth. Finally, when the server accepts
cious segments into the server and then inject fake messages the forged segment, the fake messages in the segment will
Fig. 8. Snapshot of the poisoned BGP routing table.
addresses on average to construct the hash collision and

identify the shared IPID counter. In practice, it is not easy for
an attacker to hold such a number of IPv4 addresses, limiting
the effect of the proposed attack [38]. However, we discover
that if the vulnerable server enables IPv4/IPv6 dual-stack,
Fig. 7. Snapshot of messages viewed by group members.
the attacker can easily use adequate IPv6 addresses to con-
struct hash collisions and identify the hash counter used in
be stored on the server and advertised to group members, the victim TCP connection.
as shown in Figure 7. Overall, the success rate of this attack is On Linux systems running IPv4/IPv6 dual-stack,
over 90%. the 2048 globally shared hash IPID counters are also
(2) Manipulating BGP Routing Table: Customized security used by IPv6 addresses. Therefore, once the outgoing
mechanisms for BGP have not been widely deployed yet [36], IPv6 packets are fragmented (IPID is needed only when
hence BGP messages undertaken by long-lived TCP connec- IPv6 packets are fragmented at the originator), Linux will
tions may be poisoned by leveraging our attacks. assign IPID for the fragments by choosing one from the
Experimental Setup: Due to ethical concerns, we do not 2048 global counters. Hence, once the IPID assignment for
probe and attack BGP systems on the Internet. Instead, the target TCP connection between the vulnerable server
we evaluate our attacks against BGP systems in our test-bed. and the victim client undertaken by IPv4 is downgraded to
This attack involves 3 hosts. A BGP server is equipped with hash-based policy, the attacker can use its IPv6 addresses to
Linux kernel version 5.5, listening on its port 179. A BGP construct hash collisions and identify the target hash counter
client is equipped with Ubuntu 18.04. Both the server and used in the victim connection. Next, by observing the side
the client run the BGP suite of Quagga [37] with version channel of the shared IPID counter, the attacker can hijack
1.2.0. After the client initiates a BGP connection, the two the victim connection and overcome the lack of IP addresses.
peers advertise BGP messages to each other and update their It is worth noting that the attacker needs to force the
BGP route tables. An attack machine is equipped with Ubuntu IPv6 echo reply packets (from the server to the attacker)
18.04, and it is able to send packets with a spoofed IP address. to be fragmented when observing and recording the server’s
The attacker aims to identify the potential victim client and IPID, since only fragmented IPv6 packets will contain an
hijack the BGP connection. We show that the attacker can IPv6 extension header where an IPID field is carried. The
impersonate the client and manipulate the server’s BGP route attacker can impersonate intermediate routers to issue ICMPv6
table. We assume that the server IP address and server port “Packet Too Big” messages [39] to the vulnerable server and
are publicly known. trick the server into accepting the forged messages. After
Attack Procedure: Similar to the HTTP hijacking attack, the attacker fill the IPv6 echo request packets greater than
after downgrading the server’s IPID assignment and identify- 1500 octets (supposing the vulnerable server is connected to
ing a victim client, the attacker first learn the presence of a Internet via Ethernet), the subsequent reply packets will be
BGP connection between the server and the identified client. fragmented and IPID will be assigned before being sent to
Then, it infers the exact sequence number and an acceptable the attacker. As a result, the attacker can observe the server’s
acknowledgment number to the server. Finally, the attacker IPID assignment using its IPv6 addresses, thus successfully
sends forged BGP messages to the server based on the inferred constructing hash collisions and identifying the target hash
values to poison the routing table. IPID counter shared with the victim client on the server side
Experimental Results: Figure 8 presents a snapshot of (via varying the source IPv6 address) to perform our off-path
the poisoned BGP routing table. The Network Layer TCP hijacking attack.
Reachability Information (NLRI) of network “99.99.99.0/24” We first measure vulnerable IPv4/IPv6 dual-stack servers in
and “88.88.88.0/24” is fake, which are not advertised by Alexa top 100k websites. We discover that 73,216 (more than
router 172.21.0.70 but injected by the attacker. On aver- 73.2%) of the top 100k websites enable IPv4/IPv6 dual-stack,
age, the attacker can finish BGP routing table poisoning and 14,329 (more than 14%) of them are vulnerable to our
in 214.3 seconds (including the time cost of identifying the attacks. Considering the previous measurement result, i.e., a
victim client), with a success rate over 90%. total of 22,953 websites in Alexa top 100k are vulnerable,
we can see that 8,264 vulnerable websites only run IPv4.
Aiming at vulnerable IPv4/IPv6 dual-stack servers, we can
D. Implementation and Evaluation in Dual-Stack Networks use 1,627 IPv6 addresses on average to identify the target hash
As we presented in Section VII-A, if the attacker aims IPID counter shared between our attack machine and a victim
to hijack the victim TCP connection between the vulnerable TCP connection to a IPv4 client under our control. In practice,
server and an arbitrary client, the attacker needs 1,837 IP IPv6 users are usually assigned an IPv6 prefix of 64-bit, which
Fig. 9. Geographical distribution of vulnerable dual-stack websites.
Fig. 11. Bandwidth of attack traffic in IPv4/IPv6 dual-stack and in IPv4.
hash-based IPID counter shared between the attacker and

the victim client on the TCP server side is reliable, and
hence our attack does not suffer the traditional noise
issue [16], [17], [26], [27].
Since the outgoing TCP traffic directed to irrelevant clients
uses per-socket-based IPID counters instead of the hash-based
IPID counters, irrelevant TCP traffic will not disturb our
attack. We measure and evaluate the disturbances from the
Fig. 10. CDF of the overall time costs in IPv4/IPv6 dual-stack and in IPv4. noises of non-TCP traffic in the real world and find that the
impact is also limited. We find that the hash-based IPID coun-
can easily meet the requirement for adequate IPv6 addresses to ters of more than 91% vulnerable websites in the Alexa top
construct hash collisions. Figure 9 presents the geographical 100k websites list are not disturbed at all (within 5 minutes in
distribution of the vulnerable IPv4/IPv6 dual-stack websites our experiment), which means the IPIDs are always contiguous
we detected. and there is no outgoing traffic sharing the same hash-based
We also compare the costs of implementing our attack IPID counter with the attacker at the server in this time win-
in IPv4/IPv6 dual-stack with those in single IPv4 stack. dow. Note that, less than 9% vulnerable websites are disturbed
Figure 10 shows the CDF of the time costs when imple- by non-TCP traffic, e.g., the ICMP traffic generated by these
menting our attack in IPv4/IPv6 dual-stack and in single websites, that happens to share the same hash-based IPID
IPv4 stack. The average time costs of implementing our counter with the attack traffic during the period. Considering
attack in IPv4/IPv6 dual-stack stack is about 585.9 seconds, that our attack can be finished within 215 seconds on average,
i.e., 380 seconds more than the average time costs in single the real disturbance is negligible. Moreover, other types of
IPv4 stack, which is mainly due to the time-consuming packet noises that specific to certain application/network scenarios,
fragmentation and defragmentation we triggered on IPv6 echo e.g., packet loss, can be effectively mitigated by re-running the
reply packets in order to observe the IPID in IPv6. attack multiple times. For example, in our experiments, when
Figure 11 compares the attack traffic bandwidth in we detect a potential victim, we usually conduct the detection
IPv4/IPv6 dual-stack and in single IPv4 stack. The attack process again to enhance the confidence, which incurs around
traffic bandwidth in IPv4/IPv6 dual-stack is much higher than 6 seconds additional delay but can almost eliminate the false
that in single IPv4 stack, mainly because in IPv4/IPv6 dual- positives. We confirm the results by generating random packet
stack, the echo request and reply packets that are used to loss in our experiments.
identify and observe the shared hash IPID counter in the (2) More Victim Clients Under the NAT Scenario: Network
vulnerable server are always filled greater than 1500 octets Address Translation (NAT) is a widely used technique to
(under which IP fragmentation will happen and thus IPID is overcome the shortage of IPv4 addresses [40]. Under this
enabled and assigned in the reply packets). In contrast, when scenario, multiple hosts share a public IP address. As a result,
performing our attack in single IPv4 stack, the size of echo if the attacker identifies a potential victim client who accesses
request and reply packets can be less than 60 octets, since the the Internet via NAT technique, it indicates that all hosts
IPID field is always enabled and assigned in IPv4 networks. behind the same NAT gateway are potential victims. Hence,
in practice, the actual number of victim clients is far greater
VIII. D ISCUSSION AND C OUNTERMEASURE than the number of being identified, and the NAT technique
incurs a more wide attack surface.
A. Attack Robustness (3) Shifting Sequence and Acknowledgment Numbers: A cir-
(1) IPID Noises: Unlike the global IPID counter that is noisy cumstance that may affect the success rate of our attack is the
due to the sharing between all outgoing traffic, the downgraded shifting of the sequence and acknowledgment numbers, i.e., if
the victim TCP connection has ongoing traffic, the acceptable IX. R ELATED W ORK
sequence and acknowledgment numbers may shift as the attack
IPID Side Channels: IPID ensures the uniqueness of a
is in progress. This problem can be solved by the repeated
packet for packet fragmentation and reassembly [14], [15].
inference of the acceptable sequence and acknowledgment
However, IPID has been widely abused to conduct off-path
numbers. We confirm that if the receive window does not
attacks due to the vulnerable assignment methods. Ensafi et al.
slide very quickly, e.g., under the scenarios of SSH and BGP,
performed idle port scan and network protocol analysis by
the success rate of the attack will not be affected obviously.
leveraging the side channel of global IPID counters [16].
Even if the receive window slides quickly enough to break
They also suggested that the global IPID counters can be
the attacker’s inference, the attacker can choose to exploit the
used to detect intentional packet drops [17]. By leveraging the
other side of the TCP connection where the receive window
side channel of global IPID counters, Pearce et al. measured
slides more slowly.
the reachability between any two Internet locations without
controlling a measurement vantage point [26], [27], and the
B. Countermeasures blind TCP hijacking attacks was demonstrated can be success-
We have reported the newly discovered IPID side channel to fully performed against early OSes of Windows 2K, Windows
the Linux community. Meanwhile, we also propose to throttle XP and FreeBSD 4 [41]. Jeffrey et al. showed that per-
the exploit via eliminating the root cause. destination IPID counters are also vulnerable, which can be
(1) Assigning IPID Based on the Protocol Field: The exploited to infer the number of packets between two machines
root cause of the attack is that Linux can be tricked into with UDP and ICMP and even learn the presence of a
choosing an incorrect IPID assignment policy for TCP packets. TCP connection by launching off-path attacks [19]. Alexander
When Linux assigns IPID to TCP packets, it decides which et al. detected TCP connections via IPID hash collisions.
policy to be chosen based on the DF flag in IP header, rather They leveraged the IPID of the triggered RST packets to
than the Protocol field. Therefore, attackers can clear the determine the presence of a victim TCP connection [21]. Their
DF bit of the TCP packets by forging ICMP “Fragmentation method can only detect TCP connections, but not hijacking
Needed” messages, which causes hash collisions and build a a TCP connection. Moreover, the vulnerabilities they used
side channel. To address this issue, we propose to assign IPID have been fixed since Linux kernel version 4.18. In this
by evaluating if a packet is originated from TCP based on paper, we identified a new vulnerability of abusing IPID,
the field of Protocol in IP header, instead of the DF flag. which can be exploited to perform an off-path TCP hijacking
If the packet’s Protocol field is specified as TCP, we assign attack.
IPID for the packet based on the per-socket assignment policy. TCP Hijacking Attacks: Cao et al. found that an off-
As a result, all TCP packets issued from the server will no path attacker can infer whether two arbitrary hosts on
longer share IPID counters with the attacker and the side the Internet are communicating using a TCP connection
channel can be eliminated, no matter the server enables the by utilizing a side channel in the challenge ACK mecha-
IPv4/IPv6 dual-stack or only the IPv4 stack. We implement nism, identify the sequence and acknowledgment numbers
the mechanism in Linux 4.18 and confirm its effectiveness of the connection, and then hijack the connections [8],
through real evaluation. [9]. The side channel vulnerability has been eliminated
(2) Enhancing IPID Assignment for RST Packets: Another by setting a random challenge ACK count limit. A timing
countermeasure is to change the IPID assignment of RST side channel has been uncovered in the half-duplex IEEE
packets. Since Linux kernel version 4.18, Linux directly sets 802.11 or Wi-Fi technology, which can be exploited by an
the IPID of RST packets to 0. When an attacker learn the off-path attacker to inject data into a TCP connection and force
presence of a TCP connection between the server and the the browser to cache malicious objects [10]. By exploiting
identified victim client, the attacker can forge SYN/ACK the global IPID counter which was adopted by the previous
packets. If there is no connection initiated from the specified Linux and Windows systems, Gilad et al. inferred if two
source port, the server responds with a RST packet, otherwise, hosts have established a TCP connection identified by a
with a challenge ACK packet. The IPID of the RST packet is 0, specific four-tuple and then launch off-path TCP injection
and hence it will not cause an increment to the shared IPID attacks [7], [42]–[44].
counter. It will be different from the behavior of the challenge Besides, unprivileged applications (called puppets) con-
ACK packet, which enables an indicator for the attacker to trolled by attackers running on victim hosts can also be
judge the existence of the connection. leveraged to perform off-path TCP attacks [12], [13], [45].
Thus, we propose to modify the IPID assignment for RST Qian et al. uncovered that the middlebox of firewall can
packets. Note we cannot assign IPID for RST packets based be abused to perform the TCP sequence number inference
on a socket preserved counter, since the RST packets may attack [13], and conducted a collaborative TCP sequence
be generated and issued independently of a TCP connection. number inference attack by exploiting the packet counter
Also, we cannot assign IPID for RST packets based on hash side channels [12]. Gilad et al. identified that attackers can
IPID counters, since this assignment is vulnerable to previ- conduct web cache poisoning attacks by leveraging a restricted
ous TCP/IP connections detecting attacks [21]. An empirical script in the user’s browser sandbox [45]. Compared with
method is to assign IPID for RST packets based on the these attacks, our off-path TCP attack does not need any assis-
destination of the packet. If there is a TCP connection to tance of puppets. Moreover, our attack leverages a new side
the destination (the victim client in our scenario) and the channel vulnerability appearing in the interactions among IP,
counter preserved in the socket will be selected, it can avoid ICMP, and TCP, which cannot be unearthed by the principled
the differences on the counter. methods [11].
TCP DoS Attacks: TCP SYN flooding is a major threat [12] Z. Qian, Z. M. Mao, and Y. Xie, “Collaborative TCP sequence number
that is difficult to be identified due to the similarity to inference attack: how to crack sequence number under a second,” in
Proc. ACM Conf. Comput. Commun. Secur., 2012, pp. 593–604.
the legitimate establishment of TCP connections [46]–[49]. [13] Z. Qian and Z. M. Mao, “Off-path TCP sequence number inference
Besides, more sophisticated and stealth DoS attacks have also attack-how firewall middleboxes reduce security,” in Proc. IEEE Symp.
been proposed to cause resource decreases or exhaustion of the Secur. Privacy, May 2012, pp. 347–361.
target TCP connections, such as low-rate TCP-targeted DoS [14] J. Postel, Internet Protocol, Internet Requests for Comments, Internet
Engineering Task Force, document RFC 791, Sep. 1981. [Online].
attacks [50]–[53], congesting intermediate links attacks [54], Available: http://www.rfc-editor.org/rfc/rfc791.txt
[55] and pulsing DoS attacks that manipulate the victim’s TCP [15] J. Touch, Updated Specification of the IPv4 ID Field, Internet Requests
congestion window to decrease the performance [56]. for Comments, Internet Engineering Task Force, document RFC 6864,
Feb. 2013. [Online]. Available: http://www.rfc-editor.org/rfc/rfc6864.txt
[16] R. Ensafi, J. C. Park, D. Kapur, and J. R. Crandall, “Idle port scanning
X. C ONCLUSION and non-interference analysis of network protocol stacks using model
checking,” in Proc. USENIX Secur. Symp., 2010, pp. 257–272.
In this paper, we uncover a new off-path TCP hijacking [17] R. Ensafi, J. Knockel, G. Alexander, and J. R. Crandall, “Detecting
attack that leverages a subtle side channel in the new mixed intentional packet drops on the Internet via TCP/IP side channels,” in
Proc. Int. Conf. Passive Active Netw. Meas. Berlin, Germany: Springer,
IPID assignment method of Linux kernel version 4.18 and 2014, pp. 109–118.
beyond. We find that a pure off-path attacker can downgrade [18] E. Dumazet. (2014). Inetpeer: Get RID of IP_ID_Count. [Online].
the IPID assignment for TCP packets from the more secure Available: https://lore.kernel.org/patchwork/patch/490770/
per-socket-based policy to hash-based policy, thus building a [19] J. Knockel and J. R. Crandall, “Counting packets sent between arbitrary
internet hosts,” in Proc. 4th USENIX Workshop Free Open Commun.
shared IPID counter that can be exploited to infer the state Internet (FOCI), 2014, pp. 1–14.
of a victim TCP connection. We evaluate the impacts of our [20] Bootlin. (2020). IPID Assignment in Linux Kernel. [Online]. Available:
attack on the Internet and implement the exploit under different https://elixir.bootlin.com/linux/latest/source/include/net/ip.h
[21] G. Alexander, A. M. Espinoza, and J. R. Crandall, “Detecting TCP/IP
scenarios. Our experiments show that off-path attackers can connections via IPID hash collisions,” Proc. Privacy Enhancing Tech-
perform various attacks by exploiting the newly discovered nol., vol. 2019, no. 4, pp. 311–328, Oct. 2019.
IPID side channel, e.g., resetting SSH connections, manipu- [22] X. Zhang, J. Knockel, and J. R. Crandall, “ONIS: Inferring TCP/IP-
lating web traffic and poisoning BGP routing tables. We also based trust relationships completely off-path,” in Proc. IEEE Conf.
Comput. Commun. (INFOCOM), Apr. 2018, pp. 2069–2077.
propose to eliminate the root cause of the exploit via repairing [23] J. Mogul and S. Deering, Path MTU Discovery, Internet Requests
the IPID assignment. We implement our countermeasure and for Comments, Internet Engineering Task Force, document RFC 1191,
confirm its effectiveness in practice. Nov. 1990. [Online]. Available: http://www.rfc-editor.org/rfc/rfc1191.txt
[24] J. McCann, S. Deering, and J. Mogul, Path MTU Discovery for
IP Version 6, Internet Requests for Comments, Internet Engineering
R EFERENCES Task Force, document RFC 1981, Aug. 1996. [Online]. Available:
http://www.rfc-editor.org/rfc/rfc1981.txt
[1] J. Postel, Transmission Control Protocol, Internet Requests for Com- [25] J. Postel, Internet Control Message Protocol, Internet Requests for Com-
ments, Internet Engineering Task Force, document RFC 793, Sep. 1981. ments, Internet Engineering Task Force, document RFC 792, Sep. 1981.
[Online]. Available: http://www.rfc-editor.org/rfc/rfc793.txt [Online]. Available: http://www.rfc-editor.org/rfc/rfc792.txt
[2] M. Duke, R. Braden, W. Eddy, E. Blanton, and A. Zimmermann, [26] P. Pearce, R. Ensafi, F. Li, N. Feamster, and V. Paxson, “Augur: Internet-
A Roadmap for Transmission Control Protocol (TCP) Specification wide detection of connectivity disruptions,” in Proc. IEEE Symp. Secur.
Documents, Internet Requests for Comments, Internet Engineering Privacy (SP), May 2017, pp. 427–443.
Task Force, document RFC 7414, Feb. 2015. [Online]. Available: [27] P. Pearce, R. Ensafi, F. Li, N. Feamster, and V. Paxson, “Toward
http://www.rfc-editor.org/rfc/rfc7414.txt continual measurement of global network-level censorship,” IEEE Secur.
[3] J. Touch, Defending TCP Against Spoofing Attacks, Internet Requests Privacy, vol. 16, no. 1, pp. 24–33, Jan. 2018.
for Comments, Internet Engineering Task Force, document RFC 4953, [28] M. Luckie, R. Beverly, R. Koga, K. Keys, J. A. Kroll, and K. claffy,
Jul. 2007. [Online]. Available: http://www.rfc-editor.org/rfc/rfc4953.txt “Network hygiene, incentives, and regulation: Deployment of source
[4] F. Gont and S. Bellovin, Defending Against Sequence Number Attacks, address validation in the internet,” in Proc. ACM SIGSAC Conf. Comput.
Internet Requests for Comments, Internet Engineering Task Force, Commun. Secur., 2019, pp. 465–480.
document RFC 6528, Feb. 2012. [Online]. Available: http://www.rfc- [29] B. Wu et al., “Enabling efficient source and path verification via
editor.org/rfc/rfc6528.txt probabilistic packet marking,” in Proc. IEEE/ACM 26th Int. Symp. Qual.
[5] M. Larsen and F. Gont, Recommendations for Transport-Protocol Port Service (IWQoS), Jun. 2018, pp. 1–10.
Randomization, Internet Requests for Comments, Internet Engineer- [30] F. Baker, Requirements for IP Version 4 Routers, Internet Requests
ing Task Force, document RFC 6056, Jan. 2011. [Online]. Available: for Comments, Internet Engineering Task Force, document RFC 1812,
http://www.rfc-editor.org/rfc/rfc6056.txt Jun. 1995. [Online]. Available: http://www.rfc-editor.org/rfc/rfc1812.txt
[6] A. Ramaiah, R. Stewart, and M. Dalal, Improving TCP’s Robustness [31] D. Farinacci, T. Li, S. Hanks, D. Meyer, and P. Traina, Generic
to Blind In-Window Attacks, Internet Requests for Comments, Internet Routing Encapsulation (GRE), Internet Requests for Comments, Internet
Engineering Task Force, document RFC 5961, Aug. 2010. [Online]. Engineering Task Force, document RFC 2784, Mar. 2000. [Online].
Available: http://www.rfc-editor.org/rfc/rfc5961.txt Available: http://www.rfc-editor.org/rfc/rfc2784.txt
[7] Y. Gilad and A. Herzberg, “Off-path TCP injection attacks,” ACM Trans. [32] D. Borman, B. Braden, and V. Jacobson, TCP Extensions for High
Inf. Syst. Secur., vol. 16, no. 4, p. 13, 2014. Performance, Internet Requests for Comments, Internet Engineering
[8] Y. Cao, Z. Qian, Z. Wang, T. Dao, S. V. Krishnamurthy, and Task Force, document RFC 7323, Sep. 2014. [Online]. Available:
L. M. Marvel, “Off-path TCP exploits of the challenge ACK global rate http://www.rfc-editor.org/rfc/rfc7323.txt
limit,” IEEE/ACM Trans. Netw., vol. 26, no. 2, pp. 765–778, Apr. 2018. [33] R. S. Raman, A. Stoll, J. Dalek, R. Ramesh, W. Scott, and
[9] Y. Cao et al., “Off-path TCP exploits: Global rate limit considered R. Ensafi, “Measuring the deployment of network censorship filters at
dangerous,” in Proc. 25th USENIX Secur. Symp. (USENIX Secur.), 2016, global scale,” in Proc. Netw. Distrib. Syst. Secur. Symp. (NDSS), 2020,
pp. 209–225. pp. 1–16.
[10] W. Chen and Z. Qian, “Off-path TCP exploit: How wireless routers can [34] V. Le Pochat, T. Van Goethem, S. Tajalizadehkhoob, M. Korczynski,
jeopardize your secrets,” in Proc. 27th USENIX Secur. Symp. (USENIX and W. Joosen, “Tranco: A research-oriented top sites ranking hard-
Secur.), 2018, pp. 1581–1598. ened against manipulation,” in Proc. Netw. Distrib. Syst. Secur. Symp.,
[11] Y. Cao, Z. Wang, Z. Qian, C. Song, S. V. Krishnamurthy, and P. Yu, San Diego, CA, USA, 2019, pp. 1–15.
“Principled unearthing of TCP side channel vulnerabilities,” in Proc. [35] Rocket.Chat. (2020). Web Application. [Online]. Available: https://
ACM SIGSAC Conf. Comput. Commun. Secur., Nov. 2019, pp. 211–224. rocket.chat/
[36] Y. Gilad, A. Cohen, A. Herzberg, M. Schapira, and H. Shulman, “Are we [54] J. M. Smith and M. Schuchard, “Routing around congestion: Defeating
there yet? On RPKI’s deployment and security,” in Proc. NDSS, 2017, DDoS attacks and adverse network conditions via reactive BGP routing,”
pp. 1–15. in Proc. IEEE Symp. Secur. Privacy (SP), May 2018, pp. 599–617.
[37] K. Ishiguro. (2020). Quagga Routing Suite. [Online]. Available: [55] M. Tran, M. S. Kang, H.-C. Hsiao, W.-H. Chiang, S.-P. Tung, and
https://www.quagga.net/ Y.-S. Wang, “On the feasibility of rerouting-based DDoS defenses,” in
[38] X. Feng, C. Fu, Q. Li, K. Sun, and K. Xu, “Off-path TCP exploits Proc. IEEE Symp. Secur. Privacy (SP), May 2019, pp. 798–813.
of the mixed IPID assignment,” in Proc. ACM SIGSAC Conf. Comput. [56] X. Luo et al., “On a new class of pulsing denial-of-service attacks and
Commun. Secur., Oct. 2020, pp. 1323–1335. the defense,” in Proc. NDSS, 2005, pp. 1–19.
[39] A. Conta, S. Deering, and M. Gupta, Internet Control Message Protocol
(ICMPv6) for the Internet Protocol Version 6 (IPv6) Specification,
Internet Requests for Comments, Internet Engineering Task Force,
document RFC 4443, Mar. 2006. [Online]. Available: http://www.rfc- Xuewei Feng received the B.E. degree from the Department of Computer
editor.org/rfc/rfc4443.txt Science and Technology, Xi’an Jiaotong University. He is currently pursuing
[40] P. Srisuresh and M. Holdrege, IP Network Address Translator (NAT) the Ph.D. degree with Tsinghua University. His research interests include
Terminology and Considerations, Internet Requests for Comments, Inter- network security and software vulnerability detection.
net Engineering Task Force, document RFC 2663, Aug. 1999. [Online].
Available: http://www.rfc-editor.org/rfc/rfc2663.txt
[41] LKM. (2007). Blind TCP/IP Hijacking is Still Alive. [Online]. Available:
http://phrack.org/issues/64/13.html Qi Li (Senior Member, IEEE) received the Ph.D. degree from Tsinghua
[42] Y. Gilad and A. Herzberg, “Spying in the dark: TCP and Tor traffic University. He has worked with ETH Zurich and The University of Texas
analysis,” in Proc. Int. Symp. Privacy Enhancing Technol. Symp. Berlin, at San Antonio. He is currently an Associate Professor with the Institute
Germany: Springer, 2012, pp. 100–119. for Network Sciences and Cyberspace, Tsinghua University. His research
[43] Y. Gilad, A. Herzberg, and H. Shulman, “Off-path hacking: The illusion interests include network and system security, particularly in internet and
of challenge-response authentication,” IEEE Secur. Privacy, vol. 12, cloud security, mobile security, and big data security. He is an Editorial
no. 5, pp. 68–77, Sep. 2014. Board Member of the IEEE T RANSACTIONS ON D EPENDABLE AND S ECURE
[44] Y. Gilad and A. Herzberg, “Off-path attacking the web,” in Proc. WOOT, C OMPUTING and ACM DTRAP.
2012, pp. 41–52.
[45] Y. Gilad and A. Herzberg, “When tolerance causes weakness: The case
of injection-friendly browsers,” in Proc. 22nd Int. Conf. World Wide
Web, 2013, pp. 435–446. Kun Sun (Member, IEEE) received the Ph.D. degree in computer science
[46] W. Eddy, TCP SYN Flooding Attacks and Common Mitigations, Inter- from North Carolina State University. He has more than 15 years of working
net Requests for Comments, Internet Engineering Task Force, doc- experience in both industry and academia. He serves as the Director for
ument RFC 4987, Aug. 2007. [Online]. Available: http://www.rfc- the Sun Security Laboratory (SunLab) and the Associate Director for the
editor.org/rfc/rfc4987.txt Center for Secure Information Systems (CSIS). He has published more than
[47] R. Bani-Hani and Z. Al-Ali, “SYN flooding attacks and counter- 100 peer-reviewed conference papers and journal articles. His research focuses
measures: A survey,” in Proc. Int. Conf. Inf. Commun. Syst., 2013, on systems and network security.
pp. 149–155.
[48] H. Wang, D. Zhang, and K. G. Shin, “Detecting SYN flooding attacks,”
in Proc. 21st Annu. Joint Conf. IEEE Comput. Commun. Societies, vol. 3,
Jun. 2002, pp. 1530–1539. Chuanpu Fu received the B.E. degree from the Department of Networking
[49] A. Aborujilah, M. N. Ismail, and S. Musa, “Detecting TCP SYN based Engineering, Dalian University of Technology, in 2020. He is currently
flooding attacks by analyzing CPU and network resources performance,” pursuing the Ph.D. degree with Tsinghua University. His research interests
in Proc. 3rd Int. Conf. Adv. Comput. Sci. Appl. Technol., Dec. 2014, include machine learning for security, and network and system security.
pp. 157–161.
[50] A. Kuzmanovic and E. W. Knightly, “Low-rate TCP-targeted denial of
service attacks: The shrew vs. the mice and elephants,” in Proc. Conf.
Appl., Technol., Archit., Protocols Comput. Commun., 2003, pp. 75–86. Ke Xu (Senior Member, IEEE) received the Ph.D. degree from the Department
[51] A. Shevtekar, K. Anantharam, and N. Ansari, “Low rate TCP denial-of- of Computer Science and Technology, Tsinghua University, Beijing, China.
service attack detection at edge routers,” IEEE Commun. Lett., vol. 9, He serves as a Full Professor for the Department of Computer Science and
no. 4, pp. 363–365, Apr. 2005. Technology, Tsinghua University. He has published more than 200 technical
[52] A. Herzberg and H. Shulman, “Stealth DoS attacks on secure channels,” papers and holds 11 U.S. patents in the research areas of next-generation
in Proc. NDSS, 2010, pp. 1–19. internet, blockchain systems, the Internet of Things, and network security.
[53] S. Jero, M. E. Hoque, D. R. Choffnes, A. Mislove, and C. Nita-Rotaru, He is a member of ACM. He served as the Steering Committee Chair for
“Automated attack discovery in TCP congestion control using a model- IEEE/ACM IWQoS and has guest-edited several special issues in IEEE and
guided approach,” in Proc. NDSS, 2018, pp. 1–15. Springer journals. He is an Editor of IEEE I NTERNET OF T HINGS J OURNAL.

Off-Path TCP Hijacking Attacks Via The Side Channel of Downgraded IPID

Uploaded by

Copyright:

Available Formats

Off-Path TCP Hijacking Attacks Via The Side Channel of Downgraded IPID

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Off-Path TCP Hijacking Attacks Via The Side Channel of Downgraded IPID

Uploaded by

Copyright:

Available Formats

IEEE/ACM TRANSACTIONS ON NETWORKING, VOL. 30, NO.

1, FEBRUARY 2022 409

Off-Path TCP Hijacking Attacks via the Side

Abstract— In this paper, we uncover a new off-path TCP I. I NTRODUCTION

to the carried next-hop MTU value in the message. The

server. Then, by observing the change of the shared IPID

Fig. 4. Detecting potential victim clients through hash collisions.

be inferred by adding the typical size of the send window to TABLE I

VII. I MPLEMENTATION AND E VALUATION

In this experiment, we select different target clients and repeat

server side) of the victim SSH connection. Finally, a spoofed

Fig. 8. Snapshot of the poisoned BGP routing table.

addresses on average to construct the hash collision and

Fig. 9. Geographical distribution of vulnerable dual-stack websites.

Fig. 11. Bandwidth of attack traffic in IPv4/IPv6 dual-stack and in IPv4.

hash-based IPID counter shared between the attacker and

You might also like